HACKING CISCO PHONES Just because you are paranoid doesn’t mean your phone isn’t listening to everything you say We discuss a set of 0-day kernel vulnerabilities in CNU (Cisco Native Unix), the operating system that powers all Cisco TNP IP phones. We demonstrate the reliable exploitation of all Cisco TNP phones via multiple vulnerabilities found in the CNU kernel. We demonstrate practical covert surveillance using constant, stealthy exfiltration of microphone data via a number of covert channels. We also demonstrate the worm-like propagation of our CNU malware, which can quickly compromise all vulnerable Cisco phones on the network. We discuss the feasibility of our attacks given physical access, internal network access and remote access across the internet. Lastly, we built on last year’s presentation by discussing the feasibility of exploiting Cisco phones from compromised HP printers and vice versa. We present the hardware and software reverse-engineering process which led to the discovery of the vulnerabilities described below. We also present methods of exploiting the following vulnerabilities remotely. Cisco PSIRT has assigned CVE Identifier CVE-2012-5445 to this issue. The issue is being disclosed via a Release Note Enclosure per the Cisco Vulnerability Policy. The Vulnerability Policy can be found at the following location: www.cisco.com I have included the contents of the Release Note Enclosure (RNE) that will be available via the Cisco Bug Search tool bellow …
See the article here:
Hacking Cisco Phones [29C3]
